How an Israeli company’s zero-click malware attack poses a risk to global security | Cybersecurity News

Simply visit a page or refresh an app to fall victim to a malware attack in which your personal data is stolen from a laptop or phone, researchers have found. You don’t even have to “click” on anything.

An Israeli spyware company was found to be behind the first known example of zero-click targeted advertising in which fraudsters or spies can steal private data and send it to external servers, with Al Jazeera journalists among the victims.

In June 2025, 45 devices used by Al Jazeera staff – including several that covered sensitive topics – were targeted with spyware that installed itself without the need to open or download any files.

An investigation by Canadian academic research unit Citizen Lab, following Al Jazeera’s initial internal investigation into the matter, found that Israeli company Candiru was behind the attacks.

Analysts say the findings are “incredibly worrying” as they confirm the existence of a new threat to global security. “We knew we were going in this direction and now this is being made public,” Remesh Srinivasan, professor of information studies at the University of California, Los Angeles, US, told Al Jazeera.

“This is the next level, because people are micro-targeted,” he said. “That’s where we are in terms of oversight.”

How zero-click malware works

Al Jazeera’s internal technology team first discovered unusual patterns on devices used by some journalists in 2024. Analysis of network logs provided to Citizen Lab by Al Jazeera in 2025 provided a clear time signature of how the attack was executed.

Malicious ads were purchased by Discover-Tech, an Israeli company posing as a legitimate advertising company, but in reality acting as a facilitator for mercenary spyware partners.

Its ad network identified Al Jazeera staff, then discreetly redirected them to an infected server owned by Candiru. The spyware company was blacklisted by the US government in 2021, when Citizen Lab found it was responsible for illegal hacking and surveillance of at least 100 activists, journalists and political activists across 10 countries.

Al Jazeera Media Network condemned the targeting of its employees’ devices and called those responsible to account.

Cybersecurity analyst and author Eddy Willems said the ads used automatically infect devices as soon as they appear on the screen, but there is an important technical nuance. “Executing code in the browser does not automatically give an attacker full control over the computer,” Willems told Al Jazeera.

“To escape the isolated environment of the browser – the ‘sandbox’ – the attacker may need a second vulnerability,” Willems said, adding that an advanced spyware operation can combine multiple vulnerabilities.

“The attacker attempts to exploit vulnerabilities to bypass security limits. This is precisely what makes this type of attack so dangerous,” the analyst said.

Once the device is infected, the malware is designed to collect a wide range of sensitive data, including files, documents, and browser data such as cookies, bookmarks, and saved credentials.

It can also capture keystrokes, take screenshots, record microphone and webcam inputs, and extract emails and messages from popular communication platforms. To avoid triggering security mechanisms, spyware often uses encrypted communication channels and divides stolen data into small pieces sent over time.

Advertising: a new global security threat?

Analysts say the Citizen Lab findings underscore the escalation of an existing threat, one that expands the scale and scope of traditional cyberattacks and makes them much harder to detect.

Although zero-click attacks are not completely new, the results describe a new technique by which online advertisements are used as a route of infection.

Stephen O’Shaughnessy, a senior lecturer in cybersecurity at the TU Dublin Blanchardstown campus in Ireland, explained that when a user opens a website or app, an automated auction sells the ad space in a fraction of a second. This auction shares data about the victim, including device ID, IP address, approximate location, and the app or site they are on.

“Discover-Tech posed as an ordinary advertiser, used that data to find their target and win the auction for that person’s screen,” O’Shaughnessy told Al Jazeera. “Anyone with a phone or browser serving ads can be contacted, without the attacker needing their phone number or email.”

“As no messages or links are involved, the victim has almost nothing to notice,” he added.

Discover-Tech was included on lists of “certified” and “approved” vendors maintained by Google and advertising industry association IAB Europe, and served ads through major networks including Google, Yandex and Beeswax.

In its report, Citizen Lab said this illustrates structural flaws in the online advertising system, which has essentially failed to detect or prevent abuse.

Discover-Tech ads appeared on devices used by personnel in national security-sensitive networks around the world, including those at various defense departments, armed forces, national cybersecurity agencies, intergovernmental organizations and media outlets, Citizen Lab discovered.

The research unit said these ads also appeared on networks used by the United Nations, NATO, the European Parliament, the European Commission and the General Secretariat of the Council of the European Union.

“Almost no one was watching”

Government networks have also been targeted in at least 24 countries, including the United States, Italy, Denmark, Norway, Australia, Russia, Mexico and Israel itself. Networks of media organizations were also targeted, mainly in Australia, Denmark and Sweden, according to Citizen Lab.

In a separate report, New York-based ad security firm Confiant said its own investigations found that some Discover-Tech ads also appeared on critical networks used by the Pentagon, the United Nations International Atomic Energy Agency and the International Criminal Court.

O’Shaughnessy said the infection had not been confirmed there – only user profiling. “But that alone is concerning, he said. “The ad system was designed to send code from strangers to billions of screens with precise targeting. Almost no one was monitoring the situation from a security perspective.

The analyst said the risk remains low for most people because these attacks are costly and target specific targets. “For high-risk people, like journalists and government officials, the best first defense is to install an ad blocker, turn off their advertising ID through their phone’s privacy settings, update everything, and enable Android’s lock mode or advanced protection,” he said.

Precautions also need to be taken within the industry and at the government level. “To combat this, the advertising industry needs to properly vet who is buying ads,” O’Shaughnessy said, while “regulators need to prevent personal data from being leaked to thousands of unknown bidders at every auction.”